LETTER | To Waze or not to Waze

LETTER | The government's directive banning civil servants from using Waze has been explained mainly by the app's Israeli links. Beneath that explanation lies a legal question that deserves airing.

Tapping "agree" on Waze means contracting with an Israeli-incorporated entity, not Google Malaysia Sdn Bhd.

Google has a local company that Malaysian regulators can summon. Waze, apparently, has no Malaysian office or staff.

Malaysia’s Personal Data Protection Act 2010 (PDPA) reaches foreign entities only in limited circumstances. Enforcing it against one with no local presence is difficult in practice, a genuine accountability gap.

Yet, Google has owned Waze since 2013, and the corporate label on a click-through contract does not reveal where data is stored or who can be served with legal process.

The government has not, as far as is publicly known, released its security assessment, so the public cannot tell whether this reasoning underpins the ban.

That raises the question of consistency. If the concern is location data held by entities beyond the reach of Malaysian regulators, it is hardly unique to one app.

Plenty of apps on civil servants' phones collect movement data under foreign terms. Malaysia’s National Cybersecurity Agency own guidance identifies Google LLC in the US as the usual provider of Google Maps for Malaysian users, with disputes generally subject to California law.

Who controls the data?

A local Google subsidiary does not automatically make Google Maps legally safer. We should examine who controls and processes the data, where it is stored, who may access it and what safeguards are independently verified.

A principle should apply evenly or not at all. The PDPA also does not appear to bind the federal and state governments themselves, so recommending a local alternative such as TuJu does not by itself settle who is accountable for users' data.

The Waze ban conflates corporate jurisdiction with actual data governance, resulting in geopolitical theatre.

Waze is a wholly owned subsidiary of Alphabet Inc., a publicly traded US tech giant subject to global data regulations.

While Waze is registered in Tel Aviv, its backend infrastructure is heavily integrated into Google’s global cloud. Waze has explicitly rejected claims of data exploitation, citing strict global privacy standards.

Banning the most effective crowd-sourced traffic app in a highly congested country deprives users of a vital tool.

Whilst, pushing them toward untested local alternatives (like TuJu) that likely lack the robust cybersecurity infrastructure Alphabet employs.

READ MORE: TuJu not built to rival Waze, LLM chair clarifies amid govt push

Three steps would help. The risk assessment, or a summary of it, should be published.

One transparent standard should apply to every location-collecting app. The PDPA should be amended to strengthen extraterritorial enforcement and to revisit the government exemption.

Waze users, civil servants or not, are entitled to clarity, not merely a prohibition.

The views expressed here are those of the author/contributor and do not necessarily represent the views of Malaysiakini.

'No time to waste over Israel's threat': Govt mulls total ban of Waze

COMMENT | TuJu vs Waze: National pride or national embarrassment?

NSC: Civil servants who defy Waze ban could face disciplinary action